Check Point Gateway PHP2Shell, CVE-2026-123039

What it is. PHP2Shell is a pair of PHP flaws, CVE-2026-109618 and CVE-2026-109619. Check Point gateways run PHP behind several web portals, and Check Point says the attackers came in through the Mobile Access Portal. CVE-2026-123039 is in the Gaia OS Dynamic CLI service. Check Point says the service runs as root and accepts commands from a local socket that any local process can write to, without checking who is connecting, so a foothold on the gateway becomes root.

Affected, per Check Point.

• PHP2Shell, per sk1000302. Security Gateways R81.20, R82, R82.10 and R82.20, and end-of-support R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10. Spark Firewalls R81.10.x and R82.00.x, and end-of-support R77.20.x and R80.20.x. Only when the Mobile Access Portal, Remote Access VPN with SSL Network Extender or the Identity Awareness Captive Portal is enabled; the first two do not apply to Spark Firewalls.
• CVE-2026-123039, per sk1000362. R81, R81.10, R81.20, R82, R82.10 and R82.20. The CVE record lists Security Management as affected alongside Security Gateways, and CISA's KEV entry also names Multi-Domain Security Management Server and Scalable Platforms. Spark Firewalls and Smart-1 Cloud are not affected.

Where the sources differ. Check Point's blog and the CVE record list CVE-2026-123039 for R81.20 through R82.20. sk1000362 also lists the end-of-support R81 and R81.10. We follow the SK article. The blog's link to the November Jumbo article still read "to be added before publication" when we checked, so use sk1000302 and sk1000362 for the take numbers.

Checks, in three tiers. The first two decide exposure. The third decides priority. Run these only on systems your organization owns.

1. Is the gateway on a fixed Jumbo take? In Expert mode, cpinfo -y all lists the installed Jumbo Hotfix take. R82.20 Take 14, R82.10 Take 52, R82 Take 132 and R81.20 Take 174 or later fix both flaws. Check Security Management Servers too, including Multi-Domain servers, since Check Point says to install the Jumbo on them as well. R80.x and R81 have no listed fix; plan the upgrade.
2. Is a PHP-backed portal reachable? Check whether the Mobile Access, Remote Access VPN with SSL Network Extender or Identity Awareness Captive Portal feature is enabled on the gateway object in SmartConsole. Then test from the internet and from user networks whether the portal answers. An enabled portal on a gateway without the fixed take or hotfix is exposed to PHP2Shell.
3. Is dynamic_server running? Check Point gives this Expert mode command in sk1000362.
   ps auxw | grep -v grep | grep 'dynamic_server'
   If it is running on a gateway without the fixed take, a foothold from PHP2Shell can become root. Then look at what the gateway reaches, since Check Point Research says the attackers used gateways to move into internal systems.

The fixed Jumbo take is the fix for both flaws. These cover the gap, each under the condition stated.

• Install the standalone PHP2Shell hotfix. sk1000302 has hotfix packages for R82.20, R82.10, R82, R81.20 and R81.10. Install it on each gateway, cluster member and standalone server; it needs a reboot. It closes the entry point only and leaves CVE-2026-123039 open.
• Stop dynamic_server. sk1000362 says to stop the process and keep it from restarting with dbset process:dynamic_server, and to re-enable it later with dbset process:dynamic_server t. Check Point warns that the Dynamic CLI commands listed in sk144112 stop working while it is off. This closes the root step only.
• Rely on the built-in IPS signature on R82.20 only. sk1000302 says R82.20 gateways protect themselves with the IPS signature "PHP Remote Code Execution" even when IPS and HTTPS Inspection are off. Check Point gives this for R82.20 only, and it does not cover CVE-2026-123039.

Check Point's advisory and Check Point Research list indicators for this activity, including scanning source addresses, file names and file hashes, linked under Sources. Check Point says no match does not rule out compromise. These are the reviews the sources point to.

• Processes or binaries posing as Check Point components that your team did not install, per Check Point's advisory.
• Unexpected files in /tmp or other temporary folders on the gateway.
• Unexplained gaps in firewall traffic logs, which Check Point says can follow a crash of the logging daemon.
• SSH or management sessions from the gateway to internal hosts that no administrator started.
• After installing the fixed take, blocked unauthenticated Dynamic CLI calls in the log, which sk1000362 says the fix records.

Treat a gateway with matching indicators as compromised, and involve incident response before cleanup.

Am I exposed?

You may be if a Check Point Security Gateway or Spark Firewall runs an affected version without the fixed Jumbo take or the PHP2Shell hotfix, and its Mobile Access Portal, SSL Network Extender or Identity Awareness Captive Portal can be reached from an untrusted network.

Is this being exploited?

Yes. Check Point confirmed exploitation from October 30 to November 4, 2026, through the Mobile Access Portal, followed by CVE-2026-123039 to get root. Both PHP2Shell CVEs have been on CISA KEV since October 26, and CISA added CVE-2026-123039 on November 13 with a November 16 due date. Public proof-of-concept code for PHP2Shell has been on GitHub since October 21; we have not run it.

We installed the October 23 PHP2Shell hotfix. Are we covered?

For the entry point, yes. For the root step, no. That hotfix carries the PHP fix only. Install R82.20 Take 14, R82.10 Take 52, R82 Take 132 or R81.20 Take 174, or stop dynamic_server as sk1000362 describes.

What if we can't install the Jumbo today?

Install the standalone PHP2Shell hotfix from sk1000302 and stop dynamic_server as sk1000362 describes. Both together cover the two steps Check Point describes, at the cost of the Dynamic CLI commands.

Are Spark Firewalls affected?

By PHP2Shell, yes, per sk1000302, with fixes in R82.00.11 build 998002843 and R81.10.17 build 996005005. By CVE-2026-123039, no. Check Point lists Spark Firewalls and Smart-1 Cloud as not affected.

Nov 13, 2026 (afternoon). CISA added CVE-2026-123039 to KEV on November 13 with a November 16 due date. CISA's entry also names Multi-Domain Security Management Server and Scalable Platforms. All three CVEs in the chain are now on KEV (catalog 2026.11.13).

Nov 13, 2026. First published. Check Point confirmed on November 12 that attackers exploited PHP2Shell through the Mobile Access Portal and then CVE-2026-123039 for root, from October 30 to November 4. PHP2Shell on CISA KEV since October 26; CVE-2026-123039 not on KEV (catalog 2026.11.10).

• Check Point, Security Advisory, active exploitation of PHP2Shell and local privilege escalation (Nov 12, 2026)
• Check Point sk1000302, PHP2Shell on Check Point products (hotfix since Oct 23, 2026; checked Nov 13)
• Check Point sk1000362, CVE-2026-123039 (checked Nov 13, 2026)
• Check Point Research, PHP2Shell exploitation on Check Point Gateway (indicators)
• CVE record CVE-2026-123039 (CNA Check Point) and NIST NVD (no NVD score, checked Nov 13)
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-109618 and CVE-2026-109619 added Oct 26, 2026; CVE-2026-123039 added Nov 13, 2026, due Nov 16; catalog 2026.11.13)
• Tuskira, PHP2Shell on PHP servers